The vulnerability originates from an inadequate validation of filenames used in PHP include or require statements within the Hotel Booking plugin. This flaw allows an attacker to supply a crafted path that causes the server to load or execute local files. When exploited, an attacker can read sensitive files on the server, and if local files that contain executable code are included, arbitrary code execution might be achieved, compromising the confidentiality, integrity, and availability of the website.

The affected product is the nicdark Hotel Booking plugin for WordPress, versions from the earliest release through version 3.6 inclusive. Users running any 3.6 or earlier build are potentially vulnerable.

The vulnerability has a CVSS score of 7.5, indicating high severity, but the EPSS score is less than 1%, reflecting a low current exploitation probability. It is not listed in CISA’s KEV catalogue. The attack likely requires the ability to influence the file path used for inclusion, which may be through a user-supplied parameter in the plugin’s interface; this suggests a local or authenticated vector rather than a direct remote exploit. Given the high CVSS and potential for full code execution, the risk remains significant despite the low EPSS.